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DETAILED ACTION 

1. A Request for Continued Examination under 37 CFR 1.114, including the fee set forth in 37 
CFR 1 .1 7(e), was filed in this application after final rejection. Since this application is 
eligible for continued examination under 37 CFR 1 .1 14, and the fee set forth in 37 CFR 

1 .17(e) has been timely paid, the finality of the previous office action has been withdrawn 
pursuant to 37 CFR 1.114. Applicant's submission filed on 4 June 2008 has been entered. 

2. Claims 1, 7, 1 1, 17, 23, 30 and 32 have been amended. Claims 6, 22 and 31 have been 
canceled. Claims 15 and 16 are withdrawn due to restriction requirement. No new claims 
have been added. Claims 1-5, 7-14, 17-21, 23-30 and 32-34 have been examined. 

3. Applicant's amendments and argument have been fully considered, but are moot in view of 
new ground rejection as set forth below. It is noted that Applicant's arguments are directed 
towards limitations newly added via amendments. Any well known art statements from the 
last office action not argued by the Applicant are taken as admittance of prior art as per 
MPEP 2144.03. 

4. Any objections or rejections not repeated below for record are withdrawn due to Applicant's 
amendment. 



Admitted Prior Art 

5. The examiner is aware of Applicant's Admitted Prior Art on pages 1 -3 of the Applicant's 
original disclosure. 



Application/Control Number: 10/784,587 Page 3 

Art Unit: 2135 

Claim Rejections - 35 USC § 101 

6. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new 
and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title. 

7. Claims 17-21, 23-29 and 32 are rejected under 35 U.S.C. 101 because the claimed invention 
is directed to non-statutory subject matter. 

Claims 17-21, 23-29 and 32 are directed to a data communication device for tracking 
incoming transmissions. However, it appears that the device would reasonably be interpreted by one 
of ordinary skill in the art as software, per se. The two elements positively recited, as part of the 
device are "mail server" and "processor". Applicant's specification provides no explicit and deliberate 
definition of any positive element, and it appears that such would reasonably be interpreted as 
representative of the software. Contrary to the Applicant's argument that processor is always 
referring to hardware, one skill in the art would understand that a processor as defined by the 
Authoritative Dictionary of IEEE Standards Terms is "software that includes the compiling, 
assembling, translating, and related functions for a specific programming language" and mail server is 
a program responsible for receiving, routing, and delivering e-mail messages to an ordinary skill in 
the art. As such, it believed that the device of claims 17-21 , 23-29 and 32 are reasonably interpreted 
as functional descriptive material, per se. 

Claim Rejections - 35 USC § 103 

8. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all obviousness 
rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in section 
102 of this title, if the differences between the subject matter sought to be patented and the prior art are such that the 
subject matter as a whole would have been obvious at the time the invention was made to a person having ordinary skill 
in the art to which said subject matter pertains. Patentability shall not be negatived by the manner in which the 
invention was made. 
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9. The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1 , 148 USPQ 459 
(1966), that are applied for establishing a background for determining obviousness under 35 
U.S.C. 103(a) are summarized as follows: 

1 . Determining the scope and contents of the prior art. 

2. Ascertaining the differences between the prior art and the claims at issue. 

3. Resolving the level of ordinary skill in the pertinent art. 

4. Considering objective evidence present in the application indicating obviousness or 
nonobviousness. 

10. Claims 1-3, 8-9, 14, 17-19, 24-25, 30 and 32 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Applicant's Admitted Prior Art in view of Fielding et al. (U.S. Pub. No. 
2004/0172551 ) and further in view of examiner's official notice. 

As per claims 1, 17 and 32, Admitted Prior Art discloses a method/data communication device 
of tracking incoming transmissions comprising: 

identifying an incoming transmission including at least one identifiable portion (e.g. page 2, 
lines 9-21 of the Applicant's Admitted Prior Art); 

computing, for each identifiable portion in the incoming transmission, a 
fingerprint indicative of the identified portion, the fingerprint being substantially unique 
to the identified portion ("The present invention is based, in part, on the observation that typical 
conventional virus diction software monitors incoming arrivals of network traffic" - page 3, lines 3-4 of 
the Applicant's original disclosure and "The conventional virus detection application also computes a 
signature for portions of incoming messages for comparison" - e.g. page 2, lines 19-20 of the 
Applicant's original disclosure ); 

receiving a set of comparison fingerprints corresponding to known portions, the 
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comparison fingerprints being predetermined ("Such conventional virus detection applications, 
therefore, employ a set of known virus fingerprints for comparison with incoming mail messages" - 
e.g. page 2, lines 22-25 of the Applicant's original disclosure); and 

comparing the stored fingerprints to the comparison fingerprints to identify stored 
fingerprints matching comparison fingerprints and, if a match is found, identifying the previous 
incoming transmission corresponding to the matching stored fingerprint ("...Conventional off-the-shelf 
(OTS) virus detection software typically scans for such undesirable transmission by matching against 
a set of known harmful transmissions. Typically, such conventional matching includes 
comparing a signature or other digital artifact... therefore, employ a set of known virus fingerprints 
for comparison with incoming mail message. . ." - e.g. page 2, lines 9-25 of the Applicant's original 
disclosure). 

Admitted Prior Art does not expressly disclose storing an indication of the subsequent 
disposition of the incoming transmission; receiving a subsequent set of comparison fingerprints, the 
subsequent set indicative of refinements to the known portions; matching the subsequent set to the 
stored fingerprints; determining, based on the matching of the subsequent set, if the subsequent set 
of comparison fingerprint is indicative of an undesirable portion in the incoming transmission; and 
selectively performing, based on the determining, a remedial action in response to the subsequent 
disposition. However, this well known feature of storing an indication of the subsequent disposition 
of the incoming transmission; receiving a subsequent set of comparison fingerprints, the subsequent 
set indicative of refinements to the known portions; matching the subsequent set to the stored 
fingerprints; determining, based on the matching of the subsequent set, if the subsequent set of 
comparison fingerprint is indicative of an undesirable portion in the incoming transmission; and 
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selectively performing, based on the determining, a remedial action in response to the subsequent 
disposition is disclosed in the abstract of Fielding et al., "..If quarantined the file is safely stored until 
virus software is updated properly with later developed virus definition file (s), which are then used to 
eradicate or clean the infected file(s) or computer systems". 

It would have been obvious to a person with ordinary skill in the art at the time of the invention 
to incorporate Fielding et al.'s storing an indication of the subsequent disposition of the incoming 
transmission; receiving a subsequent set of comparison fingerprints, the subsequent set indicative of 
refinements to the known portions; matching the subsequent set to the stored fingerprints; 
determining, based on the matching of the subsequent set, if the subsequent set of comparison 
fingerprint is indicative of an undesirable portion in the incoming transmission; and selectively 
performing, based on the determining, a remedial action in response to the subsequent disposition 
into Admitted Prior Art motivated by "require a much more effective and much faster means to 
prevent virus and other malicious software from harming their networks, servers, computers and other 
electronic devices" (e.g. par. [0008] of Fielding et al.) 

Although the Admitted Prior Art - Fielding et al. does not expressly disclose storing the 
computed fingerprint to generate a set of stored fingerprints, the Admitted Prior Art discloses on page 
2, lines 22-27, "Such conventional virus detection applications, therefore, employs a set of known 
virus fingerprints for comparing with incoming mail messages. The set contains a fingerprint for 
each known virus which the application is to protect against, and the application compares each 
fingerprint in the set to suspect message portions. Typically, vendors of such conventional virus 
detection applications provide periodic updates including additions to the fingerprint set of known 
virus". In order to make record clearer, the examiner takes official notice that It is common 
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knowledge in the art that in order to compare a set of fingerprints computed from a message against 
a set of fingerprints stored in the database or repository and in order to periodic updates to the 
fingerprint set of known virus, the computed fingerprints at least have to be stored in a temporary 
buffer or storage prior to comparison and updates. It would have been obvious to a person with 
ordinary skill in the art at the time of invention that storing the computed fingerprint to generate a set 
of stored fingerprint in order to be compared against/update the fingerprints stored in the database or 
repository. 

As per claims 2 and 18, Admitted Prior Art further discloses wherein storing further comprises 
selectively storing, if the incoming transmission does not correspond to the comparison fingerprints, 
at least one fingerprint corresponding to the identifiable portions of the incoming transmission (e.g. 
page 2, lines 19-21 of the Applicant's original disclosure). 

As per claims 3 and 19, Admitted Prior Art further discloses wherein computing the fingerprint 
value includes determining a signature and comparing comprises signature matching (e.g. page 2, 
lines 22-25 of the Applicant's original disclosure). 

As per claims 8 and 24, Admitted Prior Art - Fielding et al. - examiner's official notice further 
discloses wherein the incoming transmission further comprises a series of potentially harmful network 
transmissions, each of the incoming transmission operable to include malicious code, wherein the 
subsequent disposition includes delivery to at least one successive recipient and remedial action 
includes determining the successive recipients from the stored successive disposition and notifying 
each of the successive recipients (Admitted Prior art - page 2, lines 19-25). 
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As per claims 9 and 25, Admitted Prior Art further discloses wherein the determined 
undesirable portion did not indicate undesirable transmissions based on the comparing of a previous 
set of comparison fingerprints (e.g. page 2, lines 19-25). 

As per claim 14, Admitted Prior Art further discloses wherein the undesirable portions are 
selected from the group virus, worms and Trojan horses included as an attachment according to an 
established mail protocol (e.g. page 1, lines 4-5 and page 2, lines 9-13) 

As per claim 30, Admitted Prior Art - Fielding et al. - examiner's official notice discloses the 
claimed method of steps as applied above in claim 1 . Therefore, Admitted Prior Art - Fielding et al. - 
examiner's official notice discloses the claimed computer program/computer data signal for carrying 
out the method of steps. 

1 1 . Claims 4, 7, 20 and 23 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Admitted Prior Art - Fielding et al. (U.S. Pub. No. 20040172551) - examiner's official notice as 
applied to claims 1 and 17 above, and further in view of Paul (U.S. Patent No. 6,052,709). 

As per claims 4 and 20, Admitted Prior Art - Fielding et al. - examiner's official notice further 
discloses comprising receiving at least one successive set of comparison fingerprints, and iteratively 
comparing the successive sets of comparison fingerprints to the stored fingerprints (page 2, lines 19- 
25 of the Applicant's original disclosure). 

Admitted Prior Art - Fielding et al. - examiner's official notice does not expressly disclose 
wherein if a match is found, identifying a distribution set of the incoming message corresponding to 
the matching stored fingerprint and transmitting an indication of the match to the distribution set. 

However, Paul discloses wherein if a match is found, identifying a distribution set of the 
incoming message corresponding to the matching stored fingerprint and transmitting an indication of 
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the match to the distribution set (abstract, col. 1, line 61 - col. 2, line 24, col. 4, line 35 - col. 5, line 
9). 

It would have been obvious to a person with ordinary skill in the art at the time of the invention 
to incorporate Paul's if a match is found, identifying a distribution set of the incoming message 
corresponding to the matching stored fingerprint and transmitting an indication of the match to the 
distribution set into Admitted Prior Art - Fielding et al. - examiner's official notice motivated by "there 
is a need for a system that automatically and efficiently identifies unsolicited e-mails messages and 
controls the delivery of these messages to users" (e.g. Paul, col. 1, lines 41-49) 

As per claims 7 and 23, Paul further discloses wherein the subsequent disposition includes 
transmitting the incoming transmission to a list of successive recipients; and the remedial action is 
sending a notification to the successive recipients indicative of the matching incoming transmission 
(e.g. abstract). 

12. Claims 33 and 34 rejected under 35 U.S.C. 103(a) as being unpatentable over Admitted Prior 
Art - Fielding et al. (U.S. Pub. No. 200401 72551 ) - examiner's official notice as applied to claims 1 
and 17 above, and further in view of Van der Made (U.S. Pub. No. 20030212902). 

As per claims 33 and 34, Admitted Prior Art - Fielding et al. - examiner's official notice in the 
art does not expressly disclose identifying a previous incoming transmission is a retroactive analysis 
of a previously accepted transmission. 

Van der Made discloses identifying a previous incoming transmission is a retroactive analysis 
of a previously accepted transmission ("Most preferably, each time a new program is analyzed a new 
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instance of the AVPE is generated, free of modification by any previously virtualized programs 
including any earlier analyzed viruses... setting bits in the behavior pattern register according to the 
observed behaviors. It is these bits in the behavior pattern that are retained after the simulation is 
complete... The bits stored in the behavior pattern register are the behavior pattern and subsequent 
analysis indicates whether the virtually executed program includes behaviors indicative of the 
presence of a virus or other malignant code. ..." - e.g. par. [0037]) 

It would have been obvious to a person with ordinary skill in the art at the time of the invention 
to incorporate Van der Made's identifying a previous incoming transmission is a retroactive analysis 
of a previously accepted transmission into Admitted Prior Art - Fielding et al. - examiner's official 
notice motivated by improving techniques for detecting virus and other malicious types of code are 
desirable (e.g. Van der Made, paragraph [0013]) in order to avoid identifying a large number of false 
positives for P-code and N-code programs and to detect all virus or malicious code not previously 
identified and all virus or malicious code created after the update to the signature database will be 
detected (e.g. Van der Made, par. [0005] - [0007]). 

Allowable Subject Matter 
13. Claims 5, 10-13, 21 and 26-29 would be allowable if rewritten to overcome the above 35 
U.S.C. 101 as set forth in this Office action. Further, claims 5, 10-13, 21 and 26-29 are objected to as 
being dependent upon a rejected base claim, but would be allowable if rewritten in independent form 
including all of the limitations of the base claim and any intervening claims. 

The following is a statement of reasons for the indication of allowable subject matter: 
With regards to claims 5, 10-13, 21 and 26-29, the cited prior arts fail to teach the combination 
elements of wherein the set of comparison fingerprints are virus signatures computed from known 
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undesirable transactions, demarcating the incoming transmission into segments, each segment 
operable to yield a fingerprint, wherein comparing further comprises comparing each value in the set 
of comparison fingerprints with at least one of the segments, identifying a segment type of each 
segment, the segment type corresponding to the content included in the segment; and categorizing 
each of the segments according to a heuristic, the heuristic indicative of a likelihood of the 
categorized segment including an undesirable transmission and identifying a risk assessment of each 
of the segment types and storing the segment according to the identified risk assessment, storing 
further including identifying a duration in claims 5, 10-12,21 and 26-28. Further claims 1 3 and 29 are 
dependent claims of claims 1 2 and 28. As a result, the cited prior art fails to anticipate or render 
obvious the above-cited claims. 

Conclusion 

14. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. (See PTO-892) 

Contact Information 

Any inquiry concerning this communication or earlier communications from the examiner 
should be directed to APRIL Y. SHAN whose telephone number is (571 )270-1 01 4. The examiner can 
normally be reached on Monday - Friday, 8:00 a.m. - 5:00 p.m., EST. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, 
Kim Y. Vu can be reached on (571 ) 272-3859. The fax phone number for the organization where this 
application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the Patent Application 
Information Retrieval (PAIR) system. Status information for published applications may be obtained 
from either Private PAIR or Public PAIR. Status information for unpublished applications is available 
through Private PAIR only. For more information about the PAIR system, see http://pair- 
direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the 
Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information system, call 800- 
786-9199 (IN USA OR CANADA) or 571-272-1000. 

/April Y Shan/ 
Examiner, Art Unit 2135 

/KimYen Vu/ 

Supervisory Patent Examiner, Art Unit 2135 



